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We produce two identical keys using, for the first time, entangled trinary quantum systems 
(qutrits) for quantum key distribution. The advantage of qutrits over the normally used binary 
quantum systems is an increased coding density and a higher security margin. The qutrits are 
encoded into the orbital angular momentum of photons, namely Laguerre-Gaussian modes with az- 
imuthal index 1+1,0 and —1, respectively. The orbital angular momentum is controlled with phase 
holograms. In an Ekert-type protocol the violation of a three-dimensional Bell inequality verifies 
the security of the generated keys. A key is obtained with a qutrit error rate of approximately 10%. 

PACS numbers: 03.67.Dd, 03.65.Ud, 42.50.Dv, 42.65.Lm 
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The wish to protect information from unauthorized Hs- 
teners has driven humans from early mankind on to in- 
vent all sorts of cryptographic schemes and encryption 
algorithms. The modern computer age has made the 
security need as important and the difficulty of break- 
ing classical algorithm-based cryptography as easy as 
never. In the last decades of the 20th century cryptog- 
raphy schemes were proposed where the security relies 
on the laws of quantum mechanics Q, Q, |^ Q - An in- 
truder trying to listen in will always be detected. Be- 
cause these schemes establish identical secret keys in two 
remote locations they have since become known under 
the term Quantum Key Distribution (QKD). QKD has 
been experimentally performed using all sorts of sys- 
tems, applying various protocols, over distances of up 
to 120 km Bllllli- 

These experiments are performed 
in the lab as well as in real-life environments, such as 
the nightly sky of a metropolitan city |^ liol llll . Even 
a secure bank transfer has been performed |l2l | and com- 
mercial prototype systems are already available, which 
underlines the need and usefulness of QKD systems. 

All experiments performed so far were based on two- 
dimensional quantum systems (qubits). Only in recent 
years noteworthy research efforts have been put into 
higher-dimensional quantum systems (qudits), in partic- 
ular multi-dimensional entanglement. Especially their 
application in tests of quantum nonlocality and quan- 
tum informatiori processing have attracted substantial 
interest 0, El [11 [H OEil- For quantum cryptog- 
raphy the usage of higher-dimensional systems offers ad- 
vantages such as an increased level of tolerance to noise 
at a given level of security and a higher flux of informa- 
tion compared to the qubit cryptography schemes. In 
general a QKD protocol is considered secure as long as 
the mutual information of the two parties A and B ex- 
changing the key is greater than the mutual information 



of A and E (or B and E), where E is an eavesdrop- 
per. The possible mutual information of an eavesdrop- 
per with one of the observers is strictly related to the 
noise rate of the protocol and therefore an upper noise 
bound for a secure key distribution can be found. For 
the BB84 and the Ekert qubit schemes the limit on the 
noise ratio is 14.6 % 0|, which may be slightly improved 
with alternative qubit schemes, e.g. usin g th e full set 
of d + 1 mutually unbiased bases (MUBs) [20| ■ In con- 
trast, for three-dimensional quantum systems (qutrits) 
the noise may be as high as 22.5 % j21| for the Ekert 
based protocol. Furthermore, because a larger alphabet 
is used, each system contains more information than a 
two-dimensional one |39l |. Here we present QKD using 
entangled qutrits in an extended Ekert scheme sim- 
ilar to the first QKD experiment with entangled qubits, 
performed by Jennewein et al. |22|| . The security of the 
keys obtained is thereby confirmed by violating a three- 
dimensional Bell-type inequality. 

In the present work, the qutrits are encoded into the 
orbital angular momentum (0AM) of photons in the 
Laguerre-Gaussian modes LGp^i, which are the solution 
of the paraxial wave equation in its cylindrical coordi- 
nate representation. The index p represents the num- 
ber of radial nodes and the index I is the winding num- 
ber, with 27r/ describing the change in phase on a closed 
path around the propagation axis. Thus a mode with 
p = I = is a Gaussian mode. Throughout this pa- 
per we only consider photons with p — 0, which span an 
infinite-dimensional Hilbert space. 

It has been experimentall y s hown |2^ l23 |. and was 
later theoretically confirmed [23, |2y| , that in the process 
of parametric down-conversion the orbital angular mo- 
mentum is conserved for each individual pump photon if 
all beams are collinear. Moreover, it has been demon- 
strated that the down converted photons arc in an 
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entangled state with respect to the 0AM, which can be 
transformed into the maximally entangled state using lo- 
cal filtering [2^ . Therefore, using a pump beam with a 
Gaussian profile one can obtain the maximally entangled 
state 

^ = a|0)|0)+/3|l)|2)+7|2)|l), (1) 

with a = /3 = 7 = Here |1) is the LGo^i mode, 

1 2) the LGo,-i mode and |0) the Gaussian mode LGq^q. 
Such a maximally entangled state can violate a three- 
dimensional Bell-type inequality [isl [29| and therefore 
local realism: 

^3 ^PiAi = Bi) + P{A2 = - 1) + P{A2 = ^2)+ 
+P{Ai = B2) - P{Ai = Bi - 1) - P[A2 = Bi)- 
^P{A2 =B2-l)- P{Ai = + 1) < 2, (2) 

with 

3 

P{Aa =Bb + k)^Yl P{Aa = j, Bb = (j + k) mod 3) 
i=i 

(3) 

being the probabilities that the outcomes of observers A 
and B measuring Aa and Bb differ by k (modulo 3). The 
observables Ai, A2 and Bi,B2 correspond to different lo- 
cal analyzer settings. Note, that the local realistic bound 
for inequality ^ is the same as for the standard GHSH 
inequality [3C| ■ The maximal violation for the maximally 
entangled state is S'f"^'' = 4/(6\/3 - 9) w 2.873. It is 
interesting to note that for certain non-maximally entan- 
gled states quantum mechanics predicts an even higher 
violation, i.e. S-n^-m^x ^ ^ _^ « 2.915 The 

violation of Q has been experimentally shown by Vaziri 
et al. [33. 

To realize QKD based on an extended three- 
dimensional Ekert scheme, the observers A and B ran- 
domly switch between three settings of their transfor- 
mation holograms. Ai,A2 {Bi,B2) are the settings to 
maximally violate inequality Q (and therefore check the 
security of the protocol) and A3, B3 are settings lead- 
ing to perfect correlations and therefore are used for key 
production. A and B choose their settings independently 
and at random and also record their photon detections in- 
dependently. After sufhciently many measurement runs 
A and B compare their hologram settings. One-ninth of 
the produced data can be used for the key, while | of 
the data are for the violation of the Bell inequality and 
the remaining | have to be discarded. After this basis 
reconciliation B publicly announces his data for the Bell 
inequality check, and A computes the value of 6*3 . In the 
case that S3 > 2, the key is secure and an eavesdrop- 
per will not have gained any useful information on the 
key [43. 

In our experimental setup (figure^ we pump a type- 
I 1.5 mm thick /3-barium-borate (BBO) crystal with an 



Ar"*" laser at 351 nm. The optical pump power is ap- 
proximately 95 mW and the pump laser is vertically po- 
larized. Via spontaneous parametric down-conversion 
(SPDG) pairs of photons entangled in orbital angular 
momentum are produced. To ensure indistinguishabil- 
ity, only the energy-degenerate photons are selected via 
narrow band filters in fibre-coupled air gaps. The pro- 
duced state is almost maximally entangled, with effec- 
tive coefficients a = 0.642 ±0.009, /3 = 0.546 ±0.009 and 
7 — 0.539±0.009, which are calculated from the observed 
coincidence count rates for A3 and B3. 

In order to produce and control the LG modes we 
use transmission phase holograms — diffraction gratings 
which are interference patterns of an LGq^i mode with a 
plane wave 33, 34]. The holograms etched into quartz 
glass are Zmm x 3mm, have a periodicity of 30 ^m, and 
their first-order diffraction efficiency at 702 nm is ap- 
proximately 80 %. If a beam passes such a hologram, an 
LGo,o is, in the first diffraction order, transformed into an 
LGq.i mode If the hologram is slightly horizontally 
displaced, a superposition of the two modes is obtained, 
with the respective amplitudes being a function of the 
displacement |23j . By inverting the beam direction the 
transformation process of the hologram is also inverted 
and an LGq^i is transformed into an LGqxi- With these 
holograms it is possible to create different superpositions 
of LG modes necessary for a test of Bell's inequality and 
for our cryptographic scheme |35j . 

To transform the state of the entangled photons, a pair 
of holograms is placed in each down-conversion arm (see 
figure These transformations approximate ladder- 
operations, i.e. one is a +1 and the other a —1 operation. 
Superpositions of the three LG modes {LGo,q, LGo, i and 
LGo.^i) with different relative amplitudes and phases 
can be produced by displacing the individual holograms 
with step motors. Observers A and B now choose the 
right positions of their holograms and can then violate 
inequality |(2J). 

For the analysis of the different LG modes the beams 
first pass a 2 : 1 and then a 1 : 1 beam splitter, hence 
equally splitting them into three parts. Each one of 
the resulting beams passes a hologram and is then cou- 
pled into a single-mode fibre. Two of the holograms 
are aligned such that they transform an LGq.i (LGq.-i) 
mode into an LGq^ mode. The third hologram is off- 
centred, and therefore leaves the modes untransformed. 
Since only the LGq^ has substantial overlap with the fi- 
bre mode this arrangement acts as a probabilistic mode 
analyser with i probability of success. The probabilistic 
nature of the analysers is equivalent to a reduced detec- 
tion efficiency but otherwise leads to no additional secu- 
rity loopholes. 

In order to find the optimal settings for the violation 
of the Bell inequality each of the analyzer holograms was 
displaced by ±1.2 mm from the beam centre in 16 equal 
steps. For every one of the 83521 (17'*) combinations 
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FIG. 1: Experimental Setup for the quantum key distribution with qutrits. The source is an Ar^ laser pumping a BBO crystal 
at a wavelength o/351 nm and an optical power of approximately 95 mW. Two phase holograms in each down-conversion arm, 
mounted on computer controlled step motors, are used for transforming the incoming maximally entangled qutrit state. Proba- 
bilistic mode analyzers, consisting of beam splitters, mode selection holograms and single mode fibers, allow the differentiation 
between the three orthogonal modes LGo,-i, LGo,o and LGo.i- The detection signals are then processed in two separate logtc 
units, where the coincidences are identified via cross-sync signals. Depending on the local measurement result, a value being 
either 0, 1 or 2 is passed to the logics first-in first-out buffer (FIFO) and read out by a computer. 



of analyser settings all nine coincidences and the single 
count rates were integrated over 5 s and written to a file. 
The data was finally analysed to check for any violation 
of inequality The maximal value we found for ^3 
was 2.825 ± 0.052, which is a violation by approximately 
16 standard deviations. The respective settings in mil- 
limeters from the beam centre were 1.05, 0.75 (hologram 
1), 1.2, 0.3 (hologram 2) for A and 0.45, 1.05 (hologram 
3), 0.15, 0.0 (hologram 4) for B's side. The single count 
rates were around 19000 s""'^ and the coincidences of the 
perfect correlations about 250 s^^, with a background of 
about 7.4%, i.e. the sum over all coincidence counts in 
the unwanted channels. In table some violations of Q 
and the corresponding hologram positions are shown. 

The communication partners A and B had two differ- 
ent, completely independent, computers and logics mea- 
suring their respective count rates. They only identified 
coincidences with the help of synchronisation signals. If 
they registered both, the signal from the other side and 
a local detection, one entry, 0, 1 or 2 depending on the 
result of the local detectors, was stored locally in a com- 
puter file (see Fig. Furthermore, the current setting 
of the transformation holograms was also written to the 
data file. Each measurement lasted 1 s and the step mo- 
tors needed about 5 s to align. After many runs the data 
were analysed by comparing the bases. 



Ss. 





HI [mm] 


H2 [mm] 


H3 [mm] 


H4 [mm] 


2.825 


0.052 


+ 1.05 
+0.75 


+1.2 
+0.3 


+0.45 

+ 1.05 


+0.15 
±0.0 


2.723 


0.052 


-0.15 
-0.3 


-0.3 
±0.0 


+0.45 
+0.9 


+0.15 
-0.9 


2.629 


0.056 


-0.15 
-0.6 


-0.6 
-0.75 


-0.15 
-1.05 


-0.6 
-0.6 



TABLE I: Experimental data for three exemplary Bell param- 
eters Sz, which violate the Bell inequality by several standard 
deviations. The corresponding settings Aa and Bi,, i.e. the 
horizontal displacements of the transformation holograms in 
mm from the beam centre, are shown — HI, H2 for A 's holo- 
grams and H3, i/4 for B 's. 



The Bell parameter was = 2.688 ± 0.171, which 
represents a clear violation of local realism. This ascer- 
tained the security of the protocol. We extracted keys 
of a length of 150 trits for A and B separately (the keys 
are shown in Fig.|21). Out of the 150 trits 14 were errors, 
which corresponds to a quantum trit error rate (QTER) 
of 9.3%. This demonstrates the successful key distri- 
bution, since Bell's inequality Q is violated and addi- 
tionally the error rate is well below the maximal allowed 
noise ratio of 22.5%. Table Ull shows a possible commu- 
nication between A and B using the key generated with 
the presented QKD. 

We have, for the first time, realised an experimen- 
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Original Text 


THE „RESULT„ I S „FORTY„TWO 


Original Code 


201 021 Oil 222 122 Oil 200 202 102 201 222 022 200 222 012 112 122 201 220 222 201 211 112 


Key A 


022 001 122 110 002 100 222 201 212 222 122 212 001 221 212 002 201 121 210 212 222 122 222 


Cipher 


220 022 100 002 121 111 122 100 Oil 120 Oil 201 201 110 221 111 020 022 100 101 120 000 001 


{Codc+Kcy)mod3 




E's Text 


YI JCQNRJEPETTMZNGI JKPAB 


Cipher 


220 022 100 002 121 111 122 100 Oil 120 Oil 201 201 110 221 111 020 022 100 101 120 000 001 


Key B 


022 001 122 110 002 100 222 201 212 222 122 212 001 221 212 002 201 121 210 212 222 122 222 


Decrypted Code 


201 021 Oil 222 122 Oil 200 202 102 201 222 022 200 222 012 112 122 201 220 222 201 211 112 


(Cipher-Key) mods 




Decrypted Text 


THE „RESULT„ I S „FORTY„TWO 



TABLE II: Encryption and decryption of a short message sent between the two partners A and B using the error- corrected key 
obtained via the three-dimensional quantum key distribution. Three trits are sufficient to represent each letter of the alphabet 
plus the space character. An eavesdropper trying to intercept the message only gets random characters and hence cannot obtain 
any information on the original text, whereas observer B uses his key to decypher the original message. 



A B 



2 12 2 10 12 2 


2220210222 








1 120201012 


2 12 2 10 12 




A 


B 


2 2 12 10 110 


2 12 10 111 






1000020102 


1000020002 




2 2 00112 


02200 1 12 


1 10 2 2 2 12 2 


1 10 2 2 2 12 2 




21 1 00021 


2 110002 1 


2 12 2 112 2 1 


2 1 2 2 1 1 2 2 1 




00222201 


00222201 


2 2 112 12 2 12 


2 2 112 12 2 12 




2 12 2 2 2 12 


2 12 2 2 2 12 


1 10 2 2 12 10 


12 2 12 10 




2 2 12 12 


22 1200 12 


12 11 12 2 2 11 


12 12 12 2 2 11 




2 12 12 2 


2 12 12 2 


2 112 10 2 12 


2 112 10 2 12 




2 112 12 1 


2 112 12 1 


2 1111110 1 


0211112100 




2 12 2 2 2 1 


2 12 2 2 2 1 


12 12 2 12 2 12 


12 2 2 2 12 2 12 




12 2 2 2 2 2 


12 2 2 2 2 2 


2200201222 


2210201222 








2221012222 


2221012222 








12 12 10 2 2 2 


1201220222 









FIG. 2: On the left are the sifted keys obtained by observers A 
and B via three-dimensional quantum key distribution. The 
bold, coloured numbers are the correct trits while the plain 
numbers are errors. From a total key of 150 trits, 136 entries 
(90.7%) were the same for A and B. The security of this 
key is ascertained by the violation of the Bell inequality Jf^i) . 
with Ss ~ 2.688 ± 0.171. On the right are the keys after a 
classical error reduction, which is done by checking the parity 
of blocks of three trits and throwing away those with different 
parities. The final keys are reduced to a length of 72 trits and 
are error-free. 



mensions into other degrees of freedom of photons, such 
as time bins [s^l, or as suggested by Chen et al. 
using the four-dimensional entangled states recently re- 
alized by 0,01, might also be considered, as they can 
be transported in fibre or free-space over long distances. 
For cryptography schemes based on single qutrits, similar 
to the BB84 scheme, transformations between MUBs are 
required. With our holographic 0AM scheme it is cer- 
tainly possible to do such transformations and a protocol 
of this type is currently under investigation. In contrast 
to the polarization degree of freedom, in principle there 
is no limitation on the dimension of the two photon en- 
tanglement and therefore an extension of the qutrit to a 
more general qudit case seems feasible. 

We thank Jay Lawrence, Johannes Kofler and Martin 
Stiitz for discussions and comments on the manuscript. 
This work has been supported by the Austrian Science 
Fund (FWF) within project SFB F15, and by the Euro- 
pean Comission project RamboQ. 



tal qutrit QKD. The completely independent parties A 
and B produce keys secured by the violation of a three- 
dimensional Bell inequality by more than 4 standard de- 
viations. The sifted keys had an error rate of approxi- 
mately 10%. The effective key rate was rather low due 
to the slow motorized base change. This could be im- 
proved by implementing the base transformation with 
fast devices such as a spatial light modulator or electro 
optical switches. In addition, with a biased choice of the 
positions of the transformation holograms, the key pro- 
duction rate could be further increased. An additional 
challenge is the distortion-free transmission of 0AM- 
encoded photons over large distances. The possibilities 
of free-space and fibre links are still under investigation, 
since atmospheric turbulences and mode crosstalk in fi- 
bres have to be overcome. Gibson et al. already demon- 
strated a free-space link of photons with 0AM over a 
distance of 15 m [s^ . Alternatively, encoding higher di- 
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